CVE-2026-23831
📋 TL;DR
This CVE describes a nil pointer dereference vulnerability in Rekor's entry implementation that can cause a panic when processing attacker-controlled input with empty spec.message. The vulnerability affects Rekor versions 1.4.3 and below, allowing attackers to trigger 500 errors through malformed COSE entries. While service availability impact is minimal due to thread recovery, it could be used for denial-of-service attacks.
💻 Affected Systems
- sigstore/rekor
📦 What is this software?
Rekor by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Sustained exploitation could cause repeated thread panics leading to degraded performance or temporary service disruption in Rekor instances.
Likely Case
Attackers can trigger 500 error responses by sending malformed COSE entries, potentially causing minor service degradation.
If Mitigated
With proper monitoring and rate limiting, impact is limited to occasional 500 errors with no data compromise.
🎯 Exploit Status
Exploitation requires sending malformed COSE entries but is straightforward once the format is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.0
Vendor Advisory: https://github.com/sigstore/rekor/security/advisories/GHSA-273p-m2cw-6833
Restart Required: Yes
Instructions:
1. Stop Rekor service. 2. Update to version 1.5.0 using package manager or manual installation. 3. Restart Rekor service. 4. Verify version with 'rekor-cli version' or equivalent.
🔧 Temporary Workarounds
Input validation at proxy layer
allImplement WAF or reverse proxy rules to reject COSE entries with empty message fields
🧯 If You Can't Patch
- Implement rate limiting to prevent DoS attacks
- Monitor for 500 error spikes and block offending IPs
🔍 How to Verify
Check if Vulnerable:
Check Rekor version - if running 1.4.3 or below, system is vulnerableCheck Version:
rekor-cli version | grep VersionVerify Fix Applied:
Verify version is 1.5.0 or higher and test with malformed COSE entries to ensure no panic occurs📡 Detection & Monitoring
Log Indicators:
- Panic stack traces in logs
- Increased 500 HTTP status codes
- Recovered goroutine panics
Network Indicators:
- HTTP 500 responses to COSE entry submissions
- Unusual patterns of COSE entry submissions
SIEM Query:
http.status_code:500 AND path:"/api/v1/log/entries"